07.140 - Forensic science

This CEN Workshop Agreement (CWA) focuses on the Personnel, Tools, Processes and Legal and Ethical framework specific for mobile forensics and including the following topics:
a) Competencies;
b) device seizure;
c) data preservation;
d) data acquisition;
e) data examination and analysis;
f) documentation of all investigation steps;
g) reporting;
h) evaluation and sharing of information with other LEAs; and
i) legal and ethical considerations.
In addition to the process-related issues, the document covers requirements for new curriculum for training of LEA officers, security practitioners and criminal prosecution experts to ensure that the evidence from mobile devices is court-approved across national borders.
It is recognised that national laws and good practices applied at LEAs vary not only between different European countries but also within these countries. This CWA offers a collection of building blocks covering different aspects of mobile forensics allowing for adjustments based on national laws and regulations as well as internal rules and codes of conduct. It allows LEAs from different countries to accommodate their available technical solutions, at the same time offering a standardised collection of procedures and requirements.
It should be explicitly stated that it is not possible to cover all the possible related topics for mobile forensics. Detailed subject matters and specialisms such as Cloud Forensics, Cell Site Analysis, Interception of Communications are excluded. Similarly, the rules and regulations about chain of custody in general, plus guidance for transmission of evidence across national boundaries are excluded from this standards document.

This CEN Workshop Agreement (CWA) focuses on the Personnel, Tools, Processes and Legal and Ethical framework specific for mobile forensics and including the following topics:
a) Competencies;
b) device seizure;
c) data preservation;
d) data acquisition;
e) data examination and analysis;
f) documentation of all investigation steps;
g) reporting;
h) evaluation and sharing of information with other LEAs; and
i) legal and ethical considerations.
In addition to the process-related issues, the document covers requirements for new curriculum for training of LEA officers, security practitioners and criminal prosecution experts to ensure that the evidence from mobile devices is court-approved across national borders.
It is recognised that national laws and good practices applied at LEAs vary not only between different European countries but also within these countries. This CWA offers a collection of building blocks covering different aspects of mobile forensics allowing for adjustments based on national laws and regulations as well as internal rules and codes of conduct. It allows LEAs from different countries to accommodate their available technical solutions, at the same time offering a standardised collection of procedures and requirements.
It should be explicitly stated that it is not possible to cover all the possible related topics for mobile forensics. Detailed subject matters and specialisms such as Cloud Forensics, Cell Site Analysis, Interception of Communications are excluded. Similarly, the rules and regulations about chain of custody in general, plus guidance for transmission of evidence across national boundaries are excluded from this standards document.

The purpose of this standard is to develop uniform nomenclature for the description of forensic dental data
and define a standardized set of uniform terms to convey this information. The goal of the standard is not to
define the extent of information collected, only to be certain that common terms are used in order to aid in an
identifying human remains or a living amnesiac.

This document specifies requirements for the forensic process focusing on recognition, recording, collection, transport and storage of items of potential forensic value. It includes requirements for the assessment and examination of scenes but is also applicable to activities that occur within the facility. This document also includes quality requirements.
This document is not applicable to procedures for the recovery of data from digital storage media which is covered by ISO/IEC 27037. However, the storage medium itself can yield additional items of forensic value (e.g. fingerprints or DNA).
Annex D shows the applicability of this document to the forensic process.

This document specifies requirements for the forensic process focusing on recognition, recording, collection, transport and storage of items of potential forensic value. It includes requirements for the assessment and examination of scenes but is also applicable to activities that occur within the facility. This document also includes quality requirements.
This document is not applicable to procedures for the recovery of data from digital storage media which is covered by ISO/IEC 27037. However, the storage medium itself can yield additional items of forensic value (e.g. fingerprints or DNA).
Annex D shows the applicability of this document to the forensic process.

This document defines terms used in the ISO 21043 series of standards.

This document defines terms used in the ISO 21043 series of standards.

This document specifies requirements for the forensic process focusing on recognition, recording, collection, transport and storage of items of potential forensic value. It includes requirements for the assessment and examination of scenes but is also applicable to activities that occur within the facility. This document also includes quality requirements. This document is not applicable to procedures for the recovery of data from digital storage media which is covered by ISO/IEC 27037. However, the storage medium itself can yield additional items of forensic value (e.g. fingerprints or DNA). Annex D shows the applicability of this document to the forensic process.

This document defines terms used in the ISO 21043 series of standards.

This International Standard provides a framework for Governing bodies of organizations (including
owners, board members, directors, partners, senior executives, or similar) on the best way to prepare
an organization for digital investigations before they occur. This International Standard applies to the
development of strategic processes (and decisions) relating to the retention, availability, access, and cost
effectiveness of digital evidence disclosure. This International Standard is applicable to all types and
sizes of organizations.

ISO 18385:2016 specifies requirements for the production of products used in the collection, storage, and analysis of biological material for forensic DNA purposes, but not those consumables and reagents used in post-amplification analysis. The consumables and reagents covered by this International Standard include those used for evidence collection (sampling kits), such as swabs, containers, and packaging, and also products used in the analysis of DNA samples, such as tubes and other plasticware, disposable laboratory coats, gloves, and other consumables. ISO 18385:2016 applies to the production of consumables and reagents which do not require cleaning for continued use. This International Standard does not cover technical product specifications (i.e. product design). ISO 18385:2016 excludes microbiological testing. ISO 18385:2016 specifies a requirement for manufacturers to minimize the risk of occurrence of detectable human nuclear DNA contamination in products used by the global forensic community.

This document defines terms used in the ISO 21043 series of standards.

The purpose of this Standard is to set out standard practices for interpreting forensic results.
The committee is working on a series which, when complete, will include—
Part 1: Terms and definitions
Part 2: Recognition, recording, collection and storage of material
Part 3: Analysis
Part 4: Interpretation (this Standard)
Part 5: Reporting
Part 1 and 2 have been published

The purpose of this Standard is to set out standard practices for analysis of material for forensic purposes.
The committee is working on a series which, when complete, will include—
Part 1: Terms and definitions
Part 2: Recognition, recording, collection and storage of material
Part 3: Analysis (this Standard)
Part 4: Interpretation
Part 5: Reporting
Part 1 and 2 have been published

The purpose of this Standard is to set out standard practices for reporting forensic results.
The committee is working on a series which, when complete, will include—
Part 1: Terms and definitions
Part 2: Recognition, recording, collection and storage of material
Part 3: Analysis
Part 4: Interpretation
Part 5: Reporting (this standard)
Part 1 and 2 are published.

This document defines terms used in the ISO 21043 series of standards.

The purpose of this Standard is to set out standard practices for interpreting forensic results.
The committee is working on a series which, when complete, will include—
Part 1: Terms and definitions
Part 2: Recognition, recording, collection and storage of material
Part 3: Analysis
Part 4: Interpretation (this Standard)
Part 5: Reporting
Part 1 and 2 have been published

The purpose of this Standard is to set out standard practices for analysis of material for forensic purposes.
The committee is working on a series which, when complete, will include—
Part 1: Terms and definitions
Part 2: Recognition, recording, collection and storage of material
Part 3: Analysis (this Standard)
Part 4: Interpretation
Part 5: Reporting
Part 1 and 2 have been published

The purpose of this Standard is to set out standard practices for reporting forensic results.
The committee is working on a series which, when complete, will include—
Part 1: Terms and definitions
Part 2: Recognition, recording, collection and storage of material
Part 3: Analysis
Part 4: Interpretation
Part 5: Reporting (this standard)
Part 1 and 2 are published.